pull down to refresh
ah i see! this is something i've been trying to figure out: how much did the fingerprint of a coldcard (or information about how coldcards work) help people identify these addresses.
I've always assumed that low entropy hacks happen by someone grinding all the keys in a search space and then checking the utxo set for addresses that might be derived from these keys.
but that mental model didn't really match up with what was happening (gradual address sweeping, spotty sweeping).
i'd love to read a description of how an attacker might go about performing this specific coldcard attack (how specifically do they find addresses to sweep?). Do you know if anyone has written about this?
You are correct on how the grinding and exploring the search space happens, just the smoking gun is in the code not on the blockchain.
The way the alarm would be set is by wallets getting drained, as it would make people think, hmm maybe there is a vulnerability and I can exploit it too, let me check the code.
Yup, but in all fairness you would not be able to detect this via scanning the blockchain, the reason these keys could be detected, is because we have information on how they were generated on the device.